From: Johan Hovold Date: Sun, 8 May 2016 18:07:58 +0000 (+0200) Subject: USB: serial: keyspan: fix use-after-free in probe error path X-Git-Tag: v4.1.12-92~15^2~141 X-Git-Url: https://www.infradead.org/git/?a=commitdiff_plain;h=aa0b662a86f5f9710f67282c0b989a8423fc95bd;p=users%2Fjedix%2Flinux-maple.git USB: serial: keyspan: fix use-after-free in probe error path Orabug: 25256929 [ Upstream commit 35be1a71d70775e7bd7e45fa6d2897342ff4c9d2 ] The interface instat and indat URBs were submitted in attach, but never unlinked in release before deallocating the corresponding transfer buffers. In the case of a late probe error (e.g. due to failed minor allocation), disconnect would not have been called before release, causing the buffers to be freed while the URBs are still in use. We'd also end up with active URBs for an unbound interface. Fixes: f9c99bb8b3a1 ("USB: usb-serial: replace shutdown with disconnect, release") Cc: stable # v2.6.31 Signed-off-by: Johan Hovold Acked-by: Greg Kroah-Hartman Signed-off-by: Sasha Levin (cherry picked from commit d2e9eeb2504c73c09c415e5d4fc4cc33ffc4cb9f) Signed-off-by: Dhaval Giani --- diff --git a/drivers/usb/serial/keyspan.c b/drivers/usb/serial/keyspan.c index e07b15ed58148..7faa901ee47fb 100644 --- a/drivers/usb/serial/keyspan.c +++ b/drivers/usb/serial/keyspan.c @@ -2376,6 +2376,10 @@ static void keyspan_release(struct usb_serial *serial) s_priv = usb_get_serial_data(serial); + /* Make sure to unlink the URBs submitted in attach. */ + usb_kill_urb(s_priv->instat_urb); + usb_kill_urb(s_priv->indat_urb); + usb_free_urb(s_priv->instat_urb); usb_free_urb(s_priv->indat_urb); usb_free_urb(s_priv->glocont_urb);